Threat Hunt Analyst Mid (Top Secret)

Requirements:

• BS degree or equivalent and 2-4 years of prior relevant experience, or a master s with less than 2 years, in order to operate within the scope contemplated by the level.
  
• The candidate must currently possess a Top Secret Clearance. In addition to clearance requirement, all CBP personnel must have a current or be able to favorably pass a 5 year background investigation (BI).
  
• Experience in the areas of incident detection and response, malware analysis, or computer forensics.
  

Desired Requirements:

• Expertise in network and host-based analysis and investigation
  
• Demonstrated experience planning and executing threat hunt missions
  
• Understanding of complex Enterprise networks to include routing, switching, firewalls, proxies, load balancers
  
• Working knowledge of common (HTTP, DNS, SMB, etc) networking protocols
  
• Familiar with operation of both Windows and Linux based systems
  
• Proficient with scripting languages such as Python or PowerShell
  
• Familiarity with Splunk Search Processing Language (SPL) and/or Elastic Domain Specific Language (DSL)
  
• Demonstrated experience triaging and responding to APT activities.
  
• Experience working with various technologies and platform such as AWS, Azure, O365, containers, etc.
  
• Understanding of current cyber threat landscape
  
  

Essential Requirements:

• Top Secret Clearance
  

Physical Demands: The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job with or without reasonable accommodation. While performing the duties of this job, the employee will regularly sit, walk, stand and climb stairs and steps. May require walking long distance from parking to work station. Occasionally, movement that requires twisting at the neck and/or trunk more than the average person, squatting/ stooping/kneeling, reaching above the head, and forward motion will be required. The employee will continuously be required to repeat the same hand, arm, or finger motion many times. Manual and finger dexterity are essential to this position. Specific vision abilities required by this job include close, distance, depth perception and telling differences among colors. The employee must be able to communicate through speech with clients and public. Hearing requirements include conversation in both quiet and noisy environments. Lifting may require floor to waist, waist to shoulder, or shoulder to overhead movement of up to 20 pounds. This position demands tolerance for various levels of mental stress

Job Duties:

• Create Threat Models to better understand the DHS IT Enterprise, identify defensive gaps, and prioritize mitigations
  
• Author, update, and maintain SOPs, playbooks, work instructions
  
• Utilize Threat Intelligence and Threat Models to create threat hypotheses
  
• Plan and scope Threat Hunt Missions to verify threat hypotheses
  
• Proactively and iteratively search through systems and networks to detect advanced threats
  
• Analyze host, network, and application logs in addition to malware and code
  
• Prepare and report risk analysis and threat findings to appropriate stakeholders
  
• Create, recommend, and assist with development of new security content as the result of hunt missions to include signatures, alerts, workflows, and automation.
  
• Coordinate with different teams to improve threat detection, response, and improve overall security posture of the Enterprise